feat: release Dever 0.1.5 with direct workers and long transactions

test/dever-cli-tests/shared_toolchain.rs

@@ -18,6 +18,18 @@ use sha2::{Digest, Sha256};
 
 static NEXT_TEMPORARY: AtomicU64 = AtomicU64::new(0);
 
+fn fixture_binary(cargo_path: &str) -> PathBuf {
+    match std::env::var_os("DEVER_NATIVE_ACCEPTANCE_WORKSPACE") {
+        Some(root) => {
+            let root = PathBuf::from(root);
+            assert!(root.is_absolute());
+            root.join("target/native-release-inputs/bin")
+                .join(Path::new(cargo_path).file_name().unwrap())
+        }
+        None => cargo_path.into(),
+    }
+}
+
 #[cfg(unix)]
 #[path = "shared_toolchain_extensions.rs"]
 mod extensions;
@@ -61,7 +73,7 @@ struct TestDaemon(Child);
 #[cfg(unix)]
 impl TestDaemon {
     fn start(layout: &Layout) -> Self {
-        let child = Command::new(env!("CARGO_BIN_EXE_deverd"))
+        let child = Command::new(fixture_binary(env!("CARGO_BIN_EXE_deverd")))
             .env_clear()
             .args(["--root", layout.root().to_str().unwrap()])
             .spawn()
@@ -228,6 +240,77 @@ fn all_supported_platforms_have_one_machine_entry_and_service_contract() {
     assert!(platform_contract("freebsd").is_none());
 }
 
+#[cfg(unix)]
+#[test]
+fn signed_installation_uses_declared_modes_under_restrictive_umask() {
+    use std::os::unix::fs::PermissionsExt;
+
+    if std::env::var_os("DEVER_TEST_RESTRICTIVE_UMASK").is_none() {
+        let output = Command::new("/bin/sh")
+            .args(["-c", "umask 077; exec \"$@\"", "dever-umask-probe"])
+            .arg(std::env::current_exe().unwrap())
+            .args([
+                "--exact",
+                "signed_installation_uses_declared_modes_under_restrictive_umask",
+                "--nocapture",
+            ])
+            .env("DEVER_TEST_RESTRICTIVE_UMASK", "1")
+            .output()
+            .unwrap();
+        assert!(
+            output.status.success(),
+            "{}\n{}",
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr)
+        );
+        return;
+    }
+    let temporary = TemporaryDirectory::new();
+    let layout = Layout::new(temporary.path().join("machine"));
+    layout.initialize().unwrap();
+    let key = signing_key();
+    fs::write(
+        layout.state().join("trusted-release-key"),
+        hex(key.public_key().as_ref()),
+    )
+    .unwrap();
+    fs::set_permissions(
+        layout.state().join("trusted-release-key"),
+        fs::Permissions::from_mode(0o644),
+    )
+    .unwrap();
+    write_release(
+        &layout,
+        &key,
+        "1.0.0",
+        &temporary.path().join("dispatch"),
+        true,
+        true,
+    );
+    MachineManager::new(layout.clone())
+        .install_requested("1.0.0")
+        .unwrap();
+    for directory in [
+        layout.bin(),
+        layout.versions(),
+        layout.versions().join("1.0.0"),
+        layout
+            .versions()
+            .join("1.0.0/skills/dever-language/assets/template"),
+    ] {
+        assert_eq!(
+            fs::metadata(directory).unwrap().permissions().mode() & 0o777,
+            0o755
+        );
+    }
+    fs::set_permissions(layout.state(), fs::Permissions::from_mode(0o700)).unwrap();
+    layout.initialize().unwrap();
+    assert_eq!(
+        fs::metadata(layout.state()).unwrap().permissions().mode() & 0o777,
+        0o700
+    );
+}
+
 #[cfg(unix)]
 #[test]
 fn signed_versions_install_select_dispatch_update_and_rollback_atomically() {
@@ -310,7 +393,11 @@ fn signed_versions_install_select_dispatch_update_and_rollback_atomically() {
         fs::read_to_string(skill_path(&layout).join("SKILL.md")).unwrap(),
         "skill 1.0.0\n"
     );
-    fs::copy(env!("CARGO_BIN_EXE_dever-launcher"), layout.bin().join("dever")).unwrap();
+    fs::copy(
+        fixture_binary(env!("CARGO_BIN_EXE_dever-launcher")),
+        layout.bin().join("dever"),
+    )
+    .unwrap();
     let active_project = temporary.path().join("active-project");
     fs::create_dir_all(active_project.join("module")).unwrap();
     fs::create_dir(active_project.join("config")).unwrap();
@@ -510,7 +597,11 @@ fn installed_launcher_is_one_shared_entry_for_multiple_projects() {
         .unwrap();
 
     let launcher = layout.bin().join("dever");
-    fs::copy(env!("CARGO_BIN_EXE_dever-launcher"), &launcher).unwrap();
+    fs::copy(
+        fixture_binary(env!("CARGO_BIN_EXE_dever-launcher")),
+        &launcher,
+    )
+    .unwrap();
     let version = Command::new(&launcher)
         .env_clear()
         .arg("version")
@@ -721,7 +812,7 @@ fn deverd_rejects_a_second_instance_and_recovers_its_socket_after_exit() {
     layout.initialize().unwrap();
     let mut daemon = TestDaemon::start(&layout);
     let socket_inode = fs::symlink_metadata(layout.service_socket()).unwrap().ino();
-    let second = Command::new(env!("CARGO_BIN_EXE_deverd"))
+    let second = Command::new(fixture_binary(env!("CARGO_BIN_EXE_deverd")))
         .args(["--root", layout.root().to_str().unwrap()])
         .output()
         .unwrap();
@@ -737,7 +828,7 @@ fn deverd_rejects_a_second_instance_and_recovers_its_socket_after_exit() {
     assert!(layout.service_socket().exists());
     let lock = layout.state().join("deverd.lock");
     fs::set_permissions(&lock, fs::Permissions::from_mode(0o644)).unwrap();
-    let insecure = Command::new(env!("CARGO_BIN_EXE_deverd"))
+    let insecure = Command::new(fixture_binary(env!("CARGO_BIN_EXE_deverd")))
         .args(["--root", layout.root().to_str().unwrap()])
         .output()
         .unwrap();
@@ -1097,7 +1188,11 @@ fn active_skill_is_readable_by_other_machine_users_without_install_lock_access()
         .install_requested("1.0.0")
         .unwrap();
     let launcher = layout.bin().join("dever");
-    fs::copy(env!("CARGO_BIN_EXE_dever-launcher"), &launcher).unwrap();
+    fs::copy(
+        fixture_binary(env!("CARGO_BIN_EXE_dever-launcher")),
+        &launcher,
+    )
+    .unwrap();
     fs::set_permissions(&launcher, fs::Permissions::from_mode(0o755)).unwrap();
     let output = Command::new(&launcher)
         .args(["skill", "path"])
@@ -1193,7 +1288,11 @@ fn deverd_uses_kernel_credentials_for_other_machine_users() {
     layout.initialize().unwrap();
     let _daemon = TestDaemon::start(&layout);
     let launcher = layout.bin().join("dever");
-    fs::copy(env!("CARGO_BIN_EXE_dever-launcher"), &launcher).unwrap();
+    fs::copy(
+        fixture_binary(env!("CARGO_BIN_EXE_dever-launcher")),
+        &launcher,
+    )
+    .unwrap();
     fs::set_permissions(&launcher, fs::Permissions::from_mode(0o755)).unwrap();
     let status = Command::new(&launcher)
         .args(["cache", "status"])